Read the docs
TI-2020-18153 Aliases CVE-2020-35682GHSA-8c7x-fqjf-h7q7

Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).

Priority MEDIUM 48CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).

Why it matters now

EPSS 0.07218 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*before 11.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11100:*:*:*:*:*:*11.1 11100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11101:*:*:*:*:*:*11.1 11101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11102:*:*:*:*:*:*11.1 11102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11103:*:*:*:*:*:*11.1 11103VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11104:*:*:*:*:*:*11.1 11104VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11105:*:*:*:*:*:*11.1 11105VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11106:*:*:*:*:*:*11.1 11106VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11107:*:*:*:*:*:*11.1 11107VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11108:*:*:*:*:*:*11.1 11108VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:* Versions before 11.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11100:*:*:*:*:*:* Versions 11.1 11100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11101:*:*:*:*:*:* Versions 11.1 11101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11102:*:*:*:*:*:* Versions 11.1 11102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11103:*:*:*:*:*:* Versions 11.1 11103 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11104:*:*:*:*:*:* Versions 11.1 11104 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11105:*:*:*:*:*:* Versions 11.1 11105 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11106:*:*:*:*:*:* Versions 11.1 11106 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11107:*:*:*:*:*:* Versions 11.1 11107 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11108:*:*:*:*:*:* Versions 11.1 11108 Vulnerable ·Zohocorp
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11109:*:*:*:*:*:*11.1 11109VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11110:*:*:*:*:*:*11.1 11110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11111:*:*:*:*:*:*11.1 11111VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11112:*:*:*:*:*:*11.1 11112VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11113:*:*:*:*:*:*11.1 11113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11114:*:*:*:*:*:*11.1 11114VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11115:*:*:*:*:*:*11.1 11115VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11116:*:*:*:*:*:*11.1 11116VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11117:*:*:*:*:*:*11.1 11117VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11118:*:*:*:*:*:*11.1 11118VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11119:*:*:*:*:*:*11.1 11119VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11120:*:*:*:*:*:*11.1 11120VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11121:*:*:*:*:*:*11.1 11121VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11122:*:*:*:*:*:*11.1 11122VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11123:*:*:*:*:*:*11.1 11123VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11124:*:*:*:*:*:*11.1 11124VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11125:*:*:*:*:*:*11.1 11125VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11126:*:*:*:*:*:*11.1 11126VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11127:*:*:*:*:*:*11.1 11127VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11128:*:*:*:*:*:*11.1 11128VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11129:*:*:*:*:*:*11.1 11129VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11130:*:*:*:*:*:*11.1 11130VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11131:*:*:*:*:*:*11.1 11131VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11132:*:*:*:*:*:*11.1 11132VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11133:*:*:*:*:*:*11.1 11133VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11109:*:*:*:*:*:* Versions 11.1 11109 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11110:*:*:*:*:*:* Versions 11.1 11110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11111:*:*:*:*:*:* Versions 11.1 11111 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11112:*:*:*:*:*:* Versions 11.1 11112 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11113:*:*:*:*:*:* Versions 11.1 11113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11114:*:*:*:*:*:* Versions 11.1 11114 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11115:*:*:*:*:*:* Versions 11.1 11115 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11116:*:*:*:*:*:* Versions 11.1 11116 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11117:*:*:*:*:*:* Versions 11.1 11117 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11118:*:*:*:*:*:* Versions 11.1 11118 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11119:*:*:*:*:*:* Versions 11.1 11119 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11120:*:*:*:*:*:* Versions 11.1 11120 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11121:*:*:*:*:*:* Versions 11.1 11121 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11122:*:*:*:*:*:* Versions 11.1 11122 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11123:*:*:*:*:*:* Versions 11.1 11123 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11124:*:*:*:*:*:* Versions 11.1 11124 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11125:*:*:*:*:*:* Versions 11.1 11125 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11126:*:*:*:*:*:* Versions 11.1 11126 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11127:*:*:*:*:*:* Versions 11.1 11127 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11128:*:*:*:*:*:* Versions 11.1 11128 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11129:*:*:*:*:*:* Versions 11.1 11129 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11130:*:*:*:*:*:* Versions 11.1 11130 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11131:*:*:*:*:*:* Versions 11.1 11131 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11132:*:*:*:*:*:* Versions 11.1 11132 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11133:*:*:*:*:*:* Versions 11.1 11133 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-35682
  2. 2026-10-03 Alias added: GHSA-8c7x-fqjf-h7q7

References

Advisory 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19808 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-15358 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-06025 Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers… KEVCVSS 3.1HIGH 7.5
  • TI-2022-19395 Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to… CVSS 3.1HIGH 7.2
  • TI-2021-03384 Cross-site scripting in ManageEngine ServiceDesk Plus CVSS 3.1MEDIUM 6.1
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences